HF PanelWordPress
Manage every WordPress site in your account — updates, security hardening, admin passwords, maintenance and debug mode, and address changes.
The WordPress screen (the WordPress Toolkit) finds every WordPress site in your account and lets you look after it from one place: updates, security checks, handy switches and changing the site's address. Every change runs live in a window, so you can watch what happens.
Where: Control Panel › Websites › WordPress
WordPress sites are found by themselves. A site you install with the App installer or upload yourself shows up here without any extra step.
Install WordPress
- Click Install WordPress.
- The App installer opens with WordPress chosen. Follow the steps there.
When you have no WordPress sites yet, the screen shows No WordPress sites yet with the same button.
Choose a site
When you have more than one site, the picker at the top lists each one by its folder (without web/ and
/public_html) and its WordPress version. Click a site to show it.
The site's header shows:
- its address and folder, its WordPress version and the number of plugins;
- Up to date, or how many updates are waiting (for example 3 updates waiting);
- Maintenance mode on and Debug mode on when those are on;
- the number of known vulnerabilities in its plugins, if any.
Click Open WordPress admin to open the site's /wp-admin/ in a new tab.
Update WordPress, plugins and themes
The Updates card lists WordPress itself, every plugin and any themes with an update.
| To update | Do this |
|---|---|
| Everything at once | click Update everything in the site's header and confirm. It updates WordPress, every plugin, every theme and the translations. |
| WordPress only | click Update on the WordPress row and confirm |
| One plugin | click Update on the plugin's row |
| Every plugin | click Update all plugins |
| Themes | click Update themes on the Themes row |
A row without an update shows a green tick. Each plugin row also shows whether the plugin is active, and updates itself when its automatic updates are on.
Tip: take a quick backup before you update a big site. See Backups.
Known vulnerabilities
HF Panel checks each plugin's installed version against a free vulnerability database. A plugin with a known problem shows Known vulnerability, its severity and a link to the advisory, then either fixed in version: update now, or no fix yet: deactivate and delete it. If the database cannot be reached, the card says so.
Note: inactive plugins are worth deleting from WordPress admin. Even switched off, an outdated plugin can be used to break in.
Security
Check for changed files
Click Check now on Check for changed files. It compares the WordPress and plugin files with the official copies and lists any that were changed — a sign of hacked or injected files.
Change an administrator's password
- In Admin password, choose the administrator.
- Enter a New password of at least 8 characters.
- Click Change.
WordPress then signs that user out everywhere.
Switches
| Switch | What it does |
|---|---|
| WordPress updates itself | Every version, or Security only (security releases only — the WordPress default) |
| Plugins update themselves | Turn on or Turn off automatic updates for every plugin |
| Maintenance mode | visitors see "briefly unavailable" while you work. Turn it off when you are done. |
| Debug mode | writes PHP errors to wp-content/debug.log. They are never shown to visitors. Turn it off when done. |
| Caches | Clear empties WordPress's object cache and temporary data |
Tip: to show your own maintenance page for any website, not only WordPress, use Maintenance mode.
Security hardening
The Security hardening card is a checklist for the chosen site. The pill shows how many checks pass, for example 4/5. Each check shows ✔ (passes), ✖ (fails) or ? (unknown — not known yet).
| Check | What it means | Button |
|---|---|---|
| File editing in WordPress admin is off | stops anyone who gets into WordPress admin from changing theme and plugin code there | Fix / Undo |
| wp-config.php can only be read by your account | the file holds the database password; permissions 600 (or 640, 400, 440) keep other users out | Fix |
| XML-RPC is blocked | an old remote-publishing door that bots use to guess passwords | Fix / Undo |
| No administrator is called "admin" | fails when an administrator has a name bots try first, such as admin, administrator, root, test, wpadmin, webmaster or user | none — fix it by hand |
| Security keys (salts) are set | new keys sign everyone out, which also throws out anyone using a stolen login cookie | Refresh keys |
Click Fix all to apply every automatic fix that is needed (all but the security keys).
To fix the administrator name: in WordPress admin › Users, make a new administrator with your own name, sign in as it, then delete the old one and give its posts to the new one.
Warning: Refresh keys signs everyone out of WordPress, you included.
Change the address (search and replace)
Use this when you move the site to a new domain, or from http to https. It replaces the old address everywhere in the site's database, serialised data included.
- Check the Old address (it is filled in with the site's current address).
- Enter the New address, for example
https://yourdomain.com. - Click Dry run. The message tells you how many places in the database would change. Nothing is changed.
- Click Replace and confirm.
A real run backs up the database first and tells you where the backup was saved.
| Rule | Why |
|---|---|
| Both addresses need a dot, 4–200 characters, no spaces or quotes | otherwise: "Enter the old and the new address…" |
| The addresses must differ | "The old and the new address are the same." |
| The new address can't contain the old one | running it twice would repeat it. Replace the domain alone instead, for example old-name.com → new-name.com. |
Update all your sites at once
The Update all your sites at once card updates every WordPress site in your account, one after another. Click Plugins, Themes or Plugins and themes, then confirm. A site that fails is listed and the rest carry on.